Researcher Achieves SSTI-Based Defacement of First Partner Bank Web Service on Standoff 365
A researcher publishing under the handle grizzzer has published a detailed account of how a critical event was completed on the Standoff 365 online polygon: defacing the digital banking web service of First Partner Bank.
The target application ran at dbo.fpb.stf. Initial reconnaissance used a DNS zone transfer from the authoritative server at 10.124.1.34, which disclosed four hosts including the banking service itself.
After adding the discovered hosts to /etc/hosts, the researcher opened the login page and used Wappalyzer to identify the technology stack: React, Express, and Node.js. An interesting server-rendered endpoint was found at /docs-server/receipt that accepted an email parameter and returned HTML generated by a server-side template engine.
Fuzzing additional parameter names with Burp Suite Intruder revealed that the undocumented pretty parameter was interpreted by the Pug template engine because the application passed the entire req.query object into pug.renderFile via the spread operator. This classic SSTI condition allowed an attacker-controlled value to be injected into the generated JavaScript output.
A carefully crafted payload closed the existing string context and used process.mainModule.require to import the net and repl modules, establishing a reverse shell that provided an interactive Node.js REPL. From this shell the researcher located the file /app/public/locales/en/translation.json, which contained interface strings loaded by the React frontend.
Using a single writeFileSync command, the value of the info.welcome-to key was replaced with the string pwned by VON. Because the React application fetches the JSON file on every page load, the modified text immediately appeared on the authorization page for all users without requiring a server restart.
The complete attack path was: DNS AXFR reconnaissance, parameter fuzzing, exploitation of Pug SSTI, Node.js RCE, and modification of the localization file. The researcher emphasized that the root cause was unsafe handling of user input inside the template engine and provided several concrete mitigation steps, including restricting DNS zone transfers, updating Pug to version 3.0.3 or later, and avoiding direct forwarding of query parameters into template options.
Related articles
Stored XSS in Telegram Desktop Allows Silent Data Exfiltration via Chat Export
Researchers at ExPatch Vulnerability Research discovered a stored XSS vulnerability in Telegram Desktop that could be triggered when users exported chat history to HTML. The flaw resided in export_output_html.cpp where button text from inline keyboards was not passed through the SerializeString function, allowing arbitrary HTML and JavaScript to execute upon opening the exported file. Attackers could deliver the payload through a bot that never joined the target group, relying on message forwarding to reach victims. Once executed, the script exfiltrated all visible messages, chat metadata, and file paths to an attacker-controlled server while optionally replacing the page with a phishing form. Telegram issued a silent fix in Beta v6.9.4 and Stable v7.0.1 without publishing an advisory or assigning a CVE. The researchers refused the offered bounty and published the details after the patch to inform users about risks from previously exported files.
Cisco Confirms Active Exploitation of Critical Secure Email Gateway Flaw Allowing Root Command Execution
Cisco has confirmed active exploitation of a critical vulnerability in its Secure Email Gateway product that allows attackers to execute arbitrary commands with root privileges. The flaw, tracked as CVE-2026-76461 with a CVSS score of 9.8, stems from insufficient input validation in the message analysis logic of AsyncOS. Attackers can trigger the issue by sending a specially crafted email containing malicious SQL instructions, which leads to arbitrary SQL command execution and full root access on affected appliances. The vulnerability impacts physical and virtual deployments running AsyncOS versions 15.5 and earlier, 16.0, and 16.5. Patches are available in versions 15.5.5-0141, 16.0.4-302, and 16.5.0-780, while the Secure Email and Web Manager and Secure Web Appliance remain unaffected. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 14 and set a September 17 remediation deadline for federal agencies.
Cisco ISE Affected by 42 Vulnerabilities Including Multiple Critical Flaws with Confirmed Exploitation
Cisco Identity Services Engine (ISE) has been found to contain 42 vulnerabilities across 15 security advisories released by Cisco Systems on September 16, 2026. Six advisories received the highest Critical rating, covering 21 individual vulnerabilities, while three were rated High and six Medium. One standout issue, CVE-2026-76460, allows attackers to bypass authentication on the management API via crafted HTTP requests and execute commands with root privileges. The flaw also impacts the Cisco ISE Passive Identity Connector (ISE-PIC). Cisco has urged immediate application of updates as some vulnerabilities are already being exploited in the wild. The product provides core network authentication and access control functions for enterprise environments.
CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog, Including Cisco ISE and Acronis Backup Flaws
The US Cybersecurity and Infrastructure Security Agency has added three vulnerabilities with confirmed in-the-wild exploitation to its Known Exploited Vulnerabilities catalog. The flaws affect Cisco Identity Services Engine, its Passive Identity Connector, and Acronis Backup plugins for cPanel and Plesk. All three entries carry a remediation deadline of September 19, 2026. The Cisco issue stems from insufficient authentication controls on an API endpoint that lets remote attackers bypass the web-based management interface. The Acronis vulnerability arises from overly permissive default settings in server-management plugins, enabling privilege escalation. Federal agencies have been directed to investigate potential compromises and apply mitigations without delay.